bugGNU nano - Bugs: bug #65279, use-after-free in goto_line_posx()

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #65279: use-after-free in goto_line_posx()

Submitter:  correctmost <correctmost>
Submitted:  Fri 09 Feb 2024 07:28:51 AM UTC
   
 
Severity:  3 - Normal Status:  Fixed
Assigned to:  bens Open/Closed:  Closed

Jump to the original submission

Thu 02 May 2024 05:36:58 AM UTC, comment #6: 

The fix was released in nano-8.0.  Thanks again for reporting.

 Benno Schulenberg <bens>
Group administrator
Mon 12 Feb 2024 06:37:40 PM UTC, comment #5: 

comment #4:

> Generating scripts that send random keystrokes to nano is a great idea.  But somehow I cannot get `xdotool` to send keystrokes to another window, only to the current window.  That can still work by running the random-keystrokes in the background and nano in the foreground, but how do you do it?


I wasn't able to get `xdotool --window` to work with nano inside of xfce4-terminal.

There's a note on the xdotool man page that might shed some light on the issue, but for now I just sleep at the beginning of the script and manually focus the nano window.

>
> Also, I guess you are running the target nano with --operatingdir to prevent the random keystrokes from accidentally doing something like: ^O ~/.ssh/keyname ^M Y, no?
>


I run the script in a test virtual machine to avoid disasters :).  I also exclude the insert-file, save, and exit keystrokes to avoid interactions with the OS.

Another hazard is when nano crashes and xdotool starts sending commands to the shell.  Adding a check like this before each command helps:

`if ! pgrep nano > /dev/null; then exit 1; fi`

My long-term plan is to figure out a way to send commands to nano in-process to avoid some of these complications.  That could also make it possible to inspect the current state of the buffer to catch subtle bugs like the missing text you spotted in https://savannah.gnu.org/bugs/?65289#comment1.


correctmost <correctmost>
Mon 12 Feb 2024 10:35:27 AM UTC, comment #4: 

Generating scripts that send random keystrokes to nano is a great idea.  But somehow I cannot get `xdotool` to send keystrokes to another window, only to the current window.  That can still work by running the random-keystrokes in the background and nano in the foreground, but how do you do it?

Also, I guess you are running the target nano with --operatingdir to prevent the random keystrokes from accidentally doing something like: ^O ~/.ssh/keyname ^M Y, no?

Benno Schulenberg <bens>
Group administrator
Sat 10 Feb 2024 05:34:51 PM UTC, comment #3: 

comment #1:

> Out of curiosity: how do you find these bugs?  Do you run a fuzzer on the input?  Or do you look at the code, see suspicious things, and then fiddle with keystrokes that exercise that area?


Thanks for the fix.

I am generating scripts that send thousands of random keystrokes to nano like this:


xdotool key "ctrl+]"
xdotool type "!"
xdotool type "E"
xdotool type "]"
xdotool type ";"
...


If I see a crash, I manually reduce the script to get simple reproduction steps.

It's pretty hacky, but it was a small experiment to see if I can find edge cases in otherwise reliable software :).

 correctmost <correctmost>
Sat 10 Feb 2024 11:18:40 AM UTC, comment #2: 

Fixed in git, commit 8fefee2d, by making sure 'openfile->current' stays valid when the line it refers to gets deleted.

 Benno Schulenberg <bens>
Group administrator
Sat 10 Feb 2024 11:10:49 AM UTC, comment #1: 

Thanks for reporting, and for the clear recipe.

The problem exists since version 6.3, commit eea3e1f0, which started to refer to 'openfile->current' when it shouldn't.

Out of curiosity: how do you find these bugs?  Do you run a fuzzer on the input?  Or do you look at the code, see suspicious things, and then fiddle with keystrokes that exercise that area?

 Benno Schulenberg <bens>
Group administrator
Fri 09 Feb 2024 07:28:51 AM UTC, original submission:  

Steps to reproduce:
1 - Start nano
2 - Type a
3 - Alt + s
4 - Ctrl + v
5 - Alt + u
--> You may have to run with Valgrind or AddressSanitizer to see the memory error

Backtrace:

==155443==ERROR: AddressSanitizer: heap-use-after-free on address 0x504000011f98 at pc 0x59219ea1f823 bp 0x7ffedac666a0 sp 0x7ffedac66698
READ of size 8 at 0x504000011f98 thread T0
    #0 0x59219ea1f822 in goto_line_posx /home/s/code/nano/src/search.c:746:57
    #1 0x59219ea26314 in do_undo /home/s/code/nano/src/text.c
    #2 0x59219ea069cd in process_a_keystroke /home/s/code/nano/src/nano.c:1685:2
    #3 0x59219ea0af93 in main /home/s/code/nano/src/nano.c:2651:3
    #4 0x76e8a3efaccf in __libc_start_call_main /usr/src/debug/glibc/glibc/csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #5 0x76e8a3efad89 in __libc_start_main /usr/src/debug/glibc/glibc/csu/../csu/libc-start.c:360:3
    #6 0x59219e8840b4 in _start (/usr/local/bin/nano+0x910b4)

0x504000011f98 is located 8 bytes inside of 48-byte region [0x504000011f90,0x504000011fc0)
freed by thread T0 here:
    #0 0x59219e9718a2 in __interceptor_free.part.0 (/usr/local/bin/nano+0x17e8a2)
    #1 0x59219ea382b4 in remove_magicline /home/s/code/nano/src/utils.c:440:3
    #2 0x59219ea25855 in do_undo /home/s/code/nano/src/text.c:518:4
    #3 0x59219ea069cd in process_a_keystroke /home/s/code/nano/src/nano.c:1685:2
    #4 0x59219ea0af93 in main /home/s/code/nano/src/nano.c:2651:3
    #5 0x76e8a3efaccf in __libc_start_call_main /usr/src/debug/glibc/glibc/csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #6 0x76e8a3efad89 in __libc_start_main /usr/src/debug/glibc/glibc/csu/../csu/libc-start.c:360:3
    #7 0x59219e8840b4 in _start (/usr/local/bin/nano+0x910b4)

previously allocated by thread T0 here:
    #0 0x59219e9728d9 in malloc (/usr/local/bin/nano+0x17f8d9)
    #1 0x59219ea366da in nmalloc /home/s/code/nano/src/utils.c:293:18
    #2 0x59219e9ff552 in make_new_node /home/s/code/nano/src/nano.c:69:24
    #3 0x59219ea38008 in new_magicline /home/s/code/nano/src/utils.c:426:28
    #4 0x59219ea05f24 in inject /home/s/code/nano/src/nano.c:1513:3
    #5 0x59219ea0668f in process_a_keystroke /home/s/code/nano/src/nano.c:1625:3
    #6 0x59219ea0af93 in main /home/s/code/nano/src/nano.c:2651:3
    #7 0x76e8a3efaccf in __libc_start_call_main /usr/src/debug/glibc/glibc/csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #8 0x76e8a3efad89 in __libc_start_main /usr/src/debug/glibc/glibc/csu/../csu/libc-start.c:360:3
    #9 0x59219e8840b4 in _start (/usr/local/bin/nano+0x910b4)

SUMMARY: AddressSanitizer: heap-use-after-free /home/s/code/nano/src/search.c:746:57 in goto_line_posx
Shadow bytes around the buggy address:
  0x504000011d00: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00 00
  0x504000011d80: fa fa 00 00 00 00 00 07 fa fa 00 00 00 00 00 00
  0x504000011e00: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fd
  0x504000011e80: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fd
  0x504000011f00: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fd
=>0x504000011f80: fa fa fd[fd]fd fd fd fd fa fa fa fa fa fa fa fa
  0x504000012000: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x504000012080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x504000012100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x504000012180: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x504000012200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==155443==ABORTING
Sorry! Nano crashed!  Code: 6.  Please report a bug.


Version: a0eebf20db7b00a50e5fabd36961dba2e81edf8e

 correctmost <correctmost>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by bens (Posted a comment)
  • -email is unavailable- added by correctmost (Submitted the item)

    •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 4 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2024-05-02 bens Open/ClosedOpen Closed
    2024-02-10 bens StatusNone Fixed
    2024-02-10 bens Assigned toNone bens
        SummaryUse-after-free in goto_line_posx use-after-free in goto_line_posx()

    Back to the top

    Copyright © 2025 Free Software Foundation, Inc.
    Verbatim copying and distribution of this entire article is permitted in any medium, provided this notice is preserved.
    The Levitating, Meditating, Flute-playing Gnu logo is a GNU GPL'ed image provided by the Nevrax Design Team.
    Page source code

    Powered by Savane 3.14-04e1.
    Corresponding source code